Supporting multiple TLS certs

[kinghrothgar]

As far as I can tell, this does not support having multiple TLS certs. My coworker @fastest963 and I are willing to put some time in to add support for this. I see there is some discussion on this topic here https://github.com/kubernetes/ingress-gce/issues/46. Are there any known hurdles for this or any suggestions on getting started?

[nikhiljindal]

Thanks for the issue and offering to help @kinghrothgar

Yes kubemci does not support multiple TLS certs and as pointed out in the issue you linked, neither does the ingress-gce controller. Going by the recent comments on that issue, it seems like it should now be possible to use multiple TLS certs but I havent tried it myself.

I will recommend trying it manually first and verifying that it works. Create a multicluster ingress using kubemci and then update the target proxy to include links to multiple certs.

Once we have verified that it works, we can update the code. Here is the relevant code that needs updating: https://github.com/GoogleCloudPlatform/k8s-multicluster-ingress/blob/dc1727b8ff165dab9a0909e4e3627aea6b6b2995/app/kubemci/pkg/gcp/targetproxy/targetproxysyncer.go#L290.

Eventually, we should add support to ingress-gce controller as well, and share more code with it. cc @bowei and @nicksardo as fyi

[nikhiljindal]

@kinghrothgar Were you able to try it out?

Also is this issue blocking you? Wondering if you have been able to use kubemci without multiple TLS certs. Feel free to chime in on https://github.com/GoogleCloudPlatform/k8s-multicluster-ingress/issues/117.

[kinghrothgar]

I don't believe this is blocking me as once I've set up the LB I believe I can go in and add more TLS certs to the LB without messing anything up. I have not tested this yet.

EDIT: We are still planning on working on this, I just have several weeks over other Kubernetes work to do before this is back on my sprint.

[nikhiljindal]

I don't believe this is blocking me as once I've set up the LB I believe I can go in and add more TLS certs to the LB without messing anything up. I have not tested this yet.

Yes it should work fine as long as you dont run kubemci command again. Running kubemci create will overwrite the TLS certs.

[nikhiljindal]

cc @prameshj who is adding support for this in ingress-gce: https://github.com/kubernetes/ingress-gce/pull/142.

We still need to work on adding support for that in kubemci

[cdaguerre]

It seems this is now support by ingress-gce but adding multiple tls certs doesnt seem to update the load balancer created by kubemci. Is this a known issue?

[lfallet]

I confirm multiple TLS certs doesn't work as-is with kubemci It can work by adding the TLS certificate manually.

ingress-gce does support multi-TLS, so we should improve kubemci. @nikhiljindal is it in the roadmap? could you be more specific about the kind of modification the code needs?

[Crazy-Hopper]

I don't believe this is blocking me as once I've set up the LB I believe I can go in and add more TLS certs to the LB without messing anything up. I have not tested this yet.

Yes it should work fine as long as you dont run kubemci command again. Running kubemci create will overwrite the TLS certs.

Actually, I just tried today and the additional certificates seem to remain intact after remove-clusters and create -f.